bcf1502093d6777effbf5a2fe6624a96b9c67648
SvelteKit already validates Origin at /api/contact; forwarding the client Origin upstream caused the prod CMS to reject local dev submissions (allowlist is prod-only). CMS forms plugin accepts no-Origin requests when REQUIRE_ORIGIN=false. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
windwiderstand
Description
Languages
TypeScript
58.9%
Svelte
38.4%
JavaScript
1.4%
CSS
1.1%